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ODP-81-963 
27 July 1981 


MEMORANDUM FOR: See Distribution 


FROM 


SUBJECT 


Attached is a draft of a memora 
Data Processing to the Director of Logistics via‘ the Director of 
Security. 


agreement with its contents. 


2 eres) 
Offi 


Securit e 


: Automatic Data Processing Equipmen Saal, 
- of Foreign Manufacture - Draft Memorandtim 


comments by 3 August 1981. 


DISTRIBUTION: 


- OS/ISSG 
OL/ADP & EB 
= OL/SS 
- c/o OL/SS 


Approved For Release 2004/05/05 : CIA-RDP84-00933R000100010024-6 


rector of 


Please review the draft to ensure that you are in 


Please submit your concurrence or 


ILLEGIB 
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ODP-81-955 
24 July 1981 


MEMORANDUM FOR: Director of Logistics 


VIA : Director of Security 

FROM : Bruce T. Johnson 

: Director of Data Processing 

SUBJECT : Automatic Data Processing Equipment of 


Foreign Manufacture 


1. Automatic data processing equipment (ADPE) manufactured 
in a foreign country is becoming more and more common in the 
Aneeicem: martenonacs and, hence, senior ODP managers are becoming 
increasingly concerned, for security reasons, about the possible 
introduction of foreign manufactured ADPE into Central 
Intelligence Agency facilities. Two primary reasons for these 
concerns are physical security considerations and the potential 


requirement for visits to Central Intelligence Agency facilities 
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by representatives of foreign manufacturers such as design or 
systems engineers. New equipment will use technology that will 


25X1 


security safeguards. When difficult, complex engineering 
problems are encountered with ADPE manufactured in the U. S., it 
usually is possible and sometimes necessary to bring specialized 
engineering personnel to Headquarters to resolve the problems. 
This clearly would not be possible with a foreign manufacturer 


having a foreign national staff. Our security concerns, 


therefore include: 
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° Embargo of spaces, upgrades, engineering changes, or 


follow-on technology. 
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25X1 
° Difficulty in access to engineering/manufacturing 
personnel. 
° possibility of having to utilize foreign national 
engineering/manufacturing specialists for non-routine 
maintenance of hardware/software. = 25X41 


2. I wish to make it clear from the outset that we 
recognize the complexity of this problem. Current Agency 
procurement and security policy does not permit contracting with 


"corporations under foreign ownership, contract or influence." 
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Our intent here is to extend this protection so that it covers 
the location and ownership of the manufacturer even when the 
equipment is obtained from a separate and distinct U. S.-owned 
vendor and the routine maintenance performed by a U. S.-owned 
maintenance SeGonioat ions We view this situation as a gap in our 
current security and procurement policy and believe for the 
reasons stated above this gap should Bee roseds Our concern here 
is driven by our knowledge of the current ADPE market where, in 
fact, foreign-manufactured [sd cre 
eee from U. S.-owned sales and service corporations. We 
therefore with the concurrence of the Director of Security and 
your concurrence would like to establish a procurement policy 
which, for eee weseonas does not permit the acquisition of 
ADPE substantially of foreign manufacture for use in CIA data 
processing activities. Until we have more eee with this 
proposed policy our working definition of ADPE substantially of 


foreign manufacture will be that critical subsystems or final 


assembly is performed by a foreign manufacturer. We further 
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define foreign manufacturer in relation to geography or ownership 
(i.e., ADPE manufactured in the U. S. by a foreign-owned firm 


would also be excluded). [| 


3. Representatives of the offices of Logistics, Security, 
General couneel and Data Processing discussed this matter on 
13 July 1981. They proposed, and I support the proposal, that 
the policy prohibiting the procurement of ADPE substantially of 
foreign manufacturer be established for use in CIA data 
processing activities. If you are in agreement and the Director 
of Security concurs, I suggest that a Headquarters Regulation be 
published establishing this policy. In the interim this policy 


could be implemented in a Procurement. Notice. [ _] 


4. Our view is that the issue of foreign manufacture will 
be evaluated along with other security factors in the overall 
contractor evaluation process. A panel of Logistics, Security 
and Data Processing personnel can be convened, if required, to 
perform the comprehensive security evaluation. —— 5] 

5. Requests for Proposal would bring this matter to the 


attention of the potential contractors and contain a 
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_ questionnaire similar to the DD Form 4415S, Certificate pertaining 
to Foreign Interests (attached). A similar form will be 


developed in ODP and coordinated with your office and the offices 


of General Counsel and Security. [ 25X1 


6. As you well know the Agency is increasingly relying on 
automatic data peoceestAG equipment for the manipulation and 
storage of classified information. This, in turn, increases our 
vulnerability to security penetrations that exploit weaknesses in 
our ADPE equipment or procedures. We believe this policy is one 
more step in improving our ADP security posture and reducing our 


risk of loss or compromise of classified information. 


Bruce T. Johnson 
Attachment: a/s 


CONCUR: 


oy. eee ee 
Director of Security 
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